Critical PHP flaws CVE-2026-109618 and CVE-2026-109619 now exploited in the wild
CRITICAL · VULNERABILITYCVE-2026-109618redteam/daily · 12 sources
- Severity
- Critical
- Highest CVSS
- 9.2
- Exploited
- Yes
- Sources
- 12
What happened
Two memory-corruption flaws in PHP, CVE-2026-109618 (out-of-memory handling) and CVE-2026-109619 (use-after-free in global state), allow unauthenticated remote code execution via crafted HTTP requests, with the risk greatest for Apache modphp. CISA added both to its Known Exploited Vulnerabilities catalogue on 26 October 2026, and AWS advises upgrading rather than relying on configuration changes alone.
For IT people · Written by AI from 12 sources · Wrong?
What to do
- Update Paloaltonetworks Pan-os to the fixed version for your release line (fixes CVE-2026-109618): 10.2.7, 11.1.4, 11.2.4, or see the CVE page for other lines.
- Update PHP to the fixed version for your release line (fixes CVE-2026-109618): 8.2.35, 8.3.36, 8.4.27, or see the CVE page for other lines.
- CVE-2026-109618 is being exploited: treat it as urgent.
- Check whether you use Paloaltonetworks Pan-os: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-109618CVSS 9.2ExploitedPHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may r
- CVE-2026-109619CVSS 9.2ExploitedPHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on thi
Full story timeline · 19 updates
- Wed 21 OctoberPHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)Fortinet PSIRT Advisories
- Critical security issue affecting PHPNCSC (UK)
- Cloudflare deploys protections against php2shell vulnerabilityCloudflare Blog (Security)
- CVE-2026-109618 published, CVSS 9.2NVD
- CVE-2026-109619 published, CVSS 9.2NVD
- PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)AWS Security Bulletins
- Thu 22 OctoberVU#763488: Memory corruption vulnerabilities in PHPCERT/CC Vulnerability Notes
- Mon 26 OctoberCVE-2026-109618 added to CISA’s exploited listCISA KEV
- CVE-2026-109619 added to CISA’s exploited listCISA KEV
- PHP Publishes Mitigation Advice for New RCE FlawInfosecurity Magazine
- Tue 27 OctoberCISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code ExecutionThe Hacker News
- Introducing the Cloudflare PHP Capture the Flag challengeCloudflare Blog (Security)
- PHP security advisory (AV26-1070) - Update 1Canadian Centre for Cyber Security
- AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2Canadian Centre for Cyber Security
- Thu 29 OctoberCVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)Palo Alto Networks Security Advisories
- PHP2Shell will persist in enterprise environments for yearsCSO Online
- Fri 30 OctoberPHP2Shell plus Fragnesia: A dangerous new route from web server to rootCSO Online
- php2shell one week later: Why one exploit doesn’t work everywhereTenable Blog
- Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management InterfacesCyber Security News
Who reported · 12 outlets
Fortinet PSIRT AdvisoriesNCSC (UK)Cloudflare Blog (Security)AWS Security BulletinsCERT/CC Vulnerability NotesInfosecurity MagazineThe Hacker NewsCanadian Centre for Cyber SecurityPalo Alto Networks Security AdvisoriesCSO OnlineTenable BlogCyber Security News
Who and what is in it
Products